SSRF address guard: is a resolved IP a public, routable unicast address? More...

#include <stdint.h>

Include dependency graph for n_ssrf.h:

This graph shows which files directly or indirectly include this file:

Functions
int	n_ssrf_ipv4_allowed (const uint8_t ip[4])
	classify an IPv4 address as safe-to-connect or not
int	n_ssrf_ipv6_allowed (const uint8_t ip[16])
	classify an IPv6 address as safe-to-connect or not

Detailed Description

SSRF address guard: is a resolved IP a public, routable unicast address?

When a program fetches an attacker-supplied URL (link previews, webhooks, avatar imports, ...) the hostname may resolve – or redirect, or DNS-rebind – to a private, loopback or link-local address to reach the local network or a cloud metadata endpoint. The safe pattern is: resolve first, classify EACH resolved address with these predicates, and connect only to an address they accept – never re-resolving the hostname afterwards.

Pure byte classification, no sockets – portable and fully testable. The caller extracts the 4 / 16 address bytes from whatever sockaddr it holds.

Author: Castagnier Mickael

Version: 1.0

Definition in file n_ssrf.h.

Function Documentation

◆ n_ssrf_ipv4_allowed()

int n_ssrf_ipv4_allowed ( const uint8_t ip[4] )

classify an IPv4 address as safe-to-connect or not

Parameters

ip	4 bytes, network order

Returns: 1 if ip is a public routable unicast address; 0 if it is unspecified / private / loopback / CGNAT / link-local / documentation / benchmark / multicast / reserved (RFC 1918, 6598, 5735, 5737, 3927, 2544, ...). NULL is rejected (0).

Definition at line 60 of file n_ssrf.c.

References v4_blocked().

Referenced by main().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ n_ssrf_ipv6_allowed()

int n_ssrf_ipv6_allowed ( const uint8_t ip[16] )

classify an IPv6 address as safe-to-connect or not